Which self-hosted CRM fits your team: SuiteCRM, EspoCRM or Twenty
Choose SuiteCRM when you need broad sales, service and campaign modules on a PHP stack and can plan a SuiteCRM 7 to 8 migration. It is the broadest of the three, and if you run SuiteCRM 7 today, the move to SuiteCRM 8 is a migration with its own guide, not an in-place upgrade, so it belongs in the budget and the risk register. Choose EspoCRM when you want a lighter PHP core on MySQL, MariaDB or PostgreSQL and are willing to pay for the Advanced Pack (reports, workflows, business process management) or the Sales Pack (products, quotes, invoices) only where you need them. Choose Twenty when your team already runs PostgreSQL and Redis, works in TypeScript and wants an API-first, developer-oriented CRM with custom objects defined as code.
Stack and hosting skills often decide this shortlist before any feature comparison does. A team that operates PHP, Apache or Nginx, and MySQL or MariaDB will carry less operating risk with SuiteCRM or EspoCRM, while a team with PostgreSQL and Redis operations experience will find Twenty's Docker Compose footprint, with a server, worker, PostgreSQL and Redis, easier to absorb. Identity matters just as much: SuiteCRM 8 offers LDAP and SAML, EspoCRM offers OpenID Connect and LDAP, and Twenty gates SSO behind its paid Organization and Enterprise plans, so confirm your identity provider, logout expectations and 2FA needs against each option.
Treat this as a provisional pick. The sections that follow cover licensing and paid features, stacks, customization, identity integration and cost of ownership, and each can change the answer. Before you commit, confirm which paid features your scope actually needs, check the supported PHP and database versions against your hosting standards, and ask a qualified implementation partner to test the shortlisted platform against your real identity provider and data volumes.
Which CRM fits which scenario
This table maps common team profiles to the CRM most likely to fit, with the condition under which each advantage matters. Read each row against your own stack, your release-line decisions and how much automation you need to pay for or build.
| Scenario | Best fit | Reason and condition |
|---|---|---|
| A PHP team with MySQL or MariaDB skills | SuiteCRM 8 or EspoCRM | Both run on PHP with MySQL or MariaDB, so existing hosting skills carry over. SuiteCRM 8 supports MariaDB 10.6 to 11.8 and MySQL 8.0 and 8.4. EspoCRM also supports PostgreSQL 15, so it is the choice only if you want to avoid the PostgreSQL route entirely. |
| A team needing broad modules out of the box | SuiteCRM 8 | SuiteCRM covers a wide set of sales, service and campaign functions in the free core. This matters most when you want those modules without buying add-ons. Confirm the specific modules you need against the SuiteCRM documentation before deciding. |
| A team wanting paid-extension-driven automation | EspoCRM | Reports, Business Process Management and workflows come from the Advanced Pack, and products, quotes and invoices come from the Sales Pack. Choose EspoCRM if you accept buying these extensions and their upgrade path. Ask the vendor for current licensing terms for self-hosted use. |
| A team on PostgreSQL that wants custom objects as code | Twenty | Twenty runs on PostgreSQL and Redis with a NestJS and React stack, and supports custom objects and fields defined as code. This matters when your platform team already runs PostgreSQL and Redis. Expect a Node-based stack that differs from PHP hosting skills, and confirm how code-defined objects are versioned in your pipeline. |
| A team needing SSO, row-level permissions or audit logs | Twenty (paid plans) or SuiteCRM 8 and EspoCRM (free core) | Twenty lists SSO, row-level permissions and audit logs on its Organization and Enterprise plans, so these are paid features. SuiteCRM 8 offers LDAP and SAML and EspoCRM offers OpenID Connect and LDAP in the free core. Confirm the logout and 2FA limits for each before relying on them. |
| A team with an existing SuiteCRM 7 estate | SuiteCRM 7 for now, then plan a SuiteCRM 8 migration | SuiteCRM 7.15 receives security fixes until January 2028. Moving to SuiteCRM 8 is a migration, not an upgrade, so customizations need review and staging tests. EspoCRM or Twenty would be a rebuild rather than a migration, so compare that effort against the migration effort. |
| A team that may later need ERP | EspoCRM or SuiteCRM, with Odoo evaluated separately | Standalone CRMs stay focused on sales and service. If ERP is likely within a few years, assess that need separately, since this page does not compare Odoo directly. |
What is free and what is paid in each platform
SuiteCRM is free to download and self-host under the GNU Affero General Public License version 3, and the SuiteCRM 8 core repository carries that license. SuiteCRM Ltd sells paid services around the free software rather than locking features behind a paid edition of the same code. Those services are separate purchases, and each one has its own scope and price that you need to request.
- SuiteASSURED support: a support package from SuiteCRM Ltd. Ask what response commitments, release coverage and escalation paths it includes for your version.
- SuiteCRM Hosted: a hosted option run by SuiteCRM Ltd. It moves hosting, backups and upgrades to the vendor, so the cost is a recurring service fee rather than your infrastructure bill.
- Implementation, training and migration: one-time or project-based services. For a SuiteCRM 7 to 8 move, ask whether the quote covers the staging test and customization review.
- Your own costs: hosting, database administration, patching and backups stay with you when you self-host, whether or not you buy a support package.
Confirm current SuiteASSURED and SuiteCRM Hosted pricing directly with SuiteCRM Ltd, since no figures for those services are part of this comparison.
The EspoCRM core is licensed under AGPL-3.0 and can be downloaded and self-hosted for free. The paid layer is a set of official extensions on top of that core, plus a managed cloud option. Automation and sales-document features are the usual reason teams look at the paid side, so check which extensions your processes need before you assume the free core covers them.
- Advanced Pack: adds reports, Business Process Management and workflows. It is an extension you buy and install on your own instance, so the license is a recurring cost to plan for.
- Sales Pack: adds products, quotes, invoices, purchases, subscriptions, inventory and payments.
- Other official extensions: VoIP, Google, Outlook, MailChimp, Zoom and Stripe integrations. Each should be checked for its own terms.
- EspoCRM Cloud prices: published at 15 US dollars per user per month on Basic (minimum 3 users), 25 dollars on Enterprise (minimum 5 users) and 69 dollars on Ultimate (minimum 10 users), with the Advanced Pack included in all cloud plans, per the EspoCRM pricing page.
The cloud prices are published figures, but a self-hosted deployment with the Advanced Pack has its own extension pricing, so ask EspoCRM for the current extension cost before you compare totals.
Twenty's open-source core can be self-hosted for free. Its pricing page lists paid plans that unlock identity and governance features, and it notes that the source code is not uniformly open. Files marked with an Enterprise license header are under a commercial license, so the free core and the enterprise code are not the same set of files.
- Pro: published at 9 US dollars per user per month.
- Organization: published at 19 US dollars per user per month. Lists row-level permissions, SAML or OIDC SSO and audit logs.
- Enterprise: published from 50,000 US dollars a year. Lists single-tenant isolation, IP allow-listing, SCIM provisioning and an SLA.
- Shared across plans: unlimited custom objects, fields, views and records, plus REST and GraphQL APIs and webhooks, according to the pricing page. The pricing page also lists SSO, row-level permissions, audit logs and encryption key rotation on the Organization and Enterprise plans.
Before you rely on the free core for sign-in or audit needs, confirm with Twenty which features sit in the Enterprise-licensed files and which are available in the open-source build you plan to run.
What drives the running cost of each CRM
Licence fees are only part of what a self-hosted CRM costs. The cards below cover the components that recur after go-live and the decisions that set their size. Check each one against your own team and hosting before comparing quotes.
Server and database footprint
Twenty's Docker Compose guide runs a server, a worker, PostgreSQL and Redis, and asks for at least 2 GB of RAM because insufficient memory can crash processes. SuiteCRM and EspoCRM run as PHP applications on MySQL or MariaDB, and EspoCRM also supports PostgreSQL 15. Ask the implementer to size the hosts, the database backups and the Redis instance separately, since each adds a line to the monthly bill and to the patch scope.
Background job scheduling
EspoCRM needs cron or a scheduled task to run background jobs, so someone must own that schedule, its logs and its failure alerts. Twenty runs a dedicated worker alongside the server and relies on its queue. SuiteCRM also depends on scheduled tasks for its workflows. Ask who monitors these jobs after go-live, because a silent cron failure is one of the most common reasons a CRM stops sending emails or updating records.
Extension licensing
EspoCRM's Advanced Pack adds reports, business process management and workflows, and its Sales Pack adds products, quotes, invoices and subscriptions. The EspoCRM pricing page includes the Advanced Pack in its cloud plans, so the choice is between buying it for a self-hosted core and building that automation yourself. Twenty's SSO, row-level permissions and audit logs sit on paid plans. Confirm which features your requirements need, then price each one as a recurring line item.
Upgrade and release cadence
Twenty ships frequent releases, with v2.48.0 published on October 16, 2026. SuiteCRM 8 minor releases arrive roughly every eight weeks, and SuiteCRM 7.15 has security fixes until January 2028. EspoCRM's current line is 10.0. Each cadence sets how often your team or partner must test, stage and roll out changes. A faster cadence means more recurring effort, while a longer support window means you may plan a migration sooner than expected.
Support contracts
SuiteCRM Ltd sells SuiteASSURED support, hosting, implementation and training services around the free software. EspoCRM offers paid cloud plans and extensions. Twenty offers paid plans and an Enterprise tier with an SLA. Self-hosted core use is free, but support is a separate purchase. Ask each vendor what response commitments are included, what is excluded, and whether the price is per user, per instance or per year.
Staff skills and hiring
The cost of skills is usually the largest recurring item. A PHP team with MySQL or MariaDB experience can run SuiteCRM or EspoCRM with its existing hosting practice. A TypeScript team with PostgreSQL and Redis skills is better placed to run Twenty. Skill gaps raise the cost of every upgrade, incident and custom module. Estimate the hours your own staff can give each month, then ask partners to quote against that figure rather than against a generic maintenance package.
How the parts fit: stack, background jobs and identity flow
SuiteCRM and EspoCRM are both PHP applications that run on MySQL or MariaDB, and EspoCRM also supports PostgreSQL 15. SuiteCRM 8.10.x lists PHP 8.2, 8.3 and 8.4, Apache 2.4, MariaDB 10.6, 10.11, 11.4 and 11.8, and MySQL 8.0 and 8.4 as supported on Linux, Unix or macOS. EspoCRM's server documentation lists PHP 8.3 to 8.5 on Apache, Nginx or IIS, with cron or a scheduled task required for background jobs. Your team should confirm that scheduled job is in place before go-live, because EspoCRM's workflows, reports and email processing depend on it. Twenty is a different shape: a TypeScript application made of a server, a worker, PostgreSQL and Redis, with the Docker Compose guide asking for at least 2 GB of RAM. The worker is a separate process that your operations team must keep running and monitor, and Redis is a dependency you must back up and secure alongside PostgreSQL.
On identity, SuiteCRM 8 offers LDAP, enabled with AUTH_TYPE=ldap, and SAML, enabled with AUTH_TYPE=saml. Before you rely on SAML, confirm the logout behavior: the 8.7.0+ implementation does not support IdP-initiated logout, so signing out at the identity provider does not end the SuiteCRM session. EspoCRM supports OpenID Connect since version 7.3, with optional user creation on first login, group-to-team mapping and backchannel logout, and it also documents LDAP for Active Directory and OpenLDAP. EspoCRM's own two-factor authentication is not compatible with OIDC, so decide early how MFA will be enforced at the identity provider. Twenty's SSO sits on its paid Organization and Enterprise plans, not in the free self-hosted core, so the sign-in design depends on the license you buy. Confirm with each vendor which identity protocol matches your directory, and test the full login and logout path on staging.
How to extend each CRM without forking the core
This sequence shows how a team adds fields, objects and automation to SuiteCRM, EspoCRM and Twenty while leaving the core code untouched, so each upgrade stays a routine event. It covers the extension mechanism for each platform, the paid pieces EspoCRM automation may depend on, and the checks that must pass after every release.
Inventory every customization before changing anything
The platform administrator, with a developer, lists each field, object, layout, script and integration already in place. Each item is marked as either a platform-level customization or a hand-edited change to core files, and each hand-edited change gets an owner. For SuiteCRM 7 instances, flag anything under the public/legacy folder, because the migration documentation warns that non-core files there may be removed. Done when the list is reviewed and every item has a recorded owner and a documented home.
Extend SuiteCRM through Studio and Module Builder
A SuiteCRM administrator adds fields, layouts and custom modules with Studio and Module Builder, which keeps changes out of the core PHP files. Confirm in the SuiteCRM 8 documentation where these tools store their output and whether any change needs code outside the admin interface, because that determines what the next upgrade must carry forward. Make the change on a staging instance first. Done when the new field and module appear on a test record and the team can list every file the tools generated.
Model EspoCRM fields and entities in Entity Manager
An EspoCRM administrator creates entities and fields in Entity Manager, which records them in the platform's metadata rather than in core code. Log each change with its reason and owner, and keep a copy of the resulting customization files in version control. Confirm with EspoCRM's documentation for your version line which files Entity Manager writes and how they are treated during upgrades. Done when the entity appears on staging, its fields save and load correctly, and the copy is stored in version control.
Build automation with Formula Script
The administrator writes before-save scripts in Formula Script and sets up workflows and business process management for EspoCRM. Reports, business process management and workflows come from the Advanced Pack, a paid official extension that is included in EspoCRM Cloud plans, so a self-hosted team should confirm the license terms and cost for its own use before designing automation that depends on it. Test each rule with a test user role to confirm permissions still hold. Done when each rule fires as designed on staging and its behavior is written down.
Define Twenty objects and fields as code
A developer defines custom objects and fields in code, so the schema lives in version control alongside the deployment. Twenty's pricing page states that unlimited custom objects, fields, views and records are included on all plans, and that REST and GraphQL APIs and webhooks come with them, so integrations can use the same model. Confirm with the Twenty repository how code-defined objects are migrated between releases on your self-hosted server. Done when a new object deploys through your standard pipeline to staging and the API returns its records.
Test core behavior after every upgrade
After each platform upgrade, the team reruns a fixed test set on staging. The set covers login and single sign-on, role-based access, record creation and editing, every custom field, each workflow or script, email and calendar sync, and the API calls that integrations depend on. The cadence follows the release line: SuiteCRM patch releases contain only security and bug fixes with no database changes, and SuiteCRM 8 minor releases arrive roughly every eight weeks. Done when the test log shows every case passing on the target version.
Review customizations against each release
Before production, a reviewer reads the release notes for the target version and checks each customization against them, looking at changed metadata, deprecated interfaces and removed files. For SuiteCRM 8, confirm whether a minor release changes the database, since patch releases are the only ones guaranteed free of such changes. For EspoCRM, recheck server requirements too, because the documented PHP range is 8.3 to 8.5. Done when each customization has a recorded status of kept, adapted or retired and the owner has signed off.
What implementing each CRM involves in practice
Implementation effort differs more by platform stack than by feature list. EspoCRM has the most packaged install path: its installation script for Ubuntu, Debian and Linux Mint deploys a Docker-based stack with Nginx and MariaDB, optional Let's Encrypt certificates, and a command.sh utility for backups, restores and upgrades. Your team still owns cron or the scheduled task that background jobs need, the OIDC or LDAP settings, and the choice of whether to keep the script's stack or match it to your existing hosting standards. SuiteCRM 8 is a different job. You build a PHP 8.2 to 8.4 environment on Apache 2.4 with MariaDB or MySQL from the compatibility matrix, then configure LDAP or SAML through AUTH_TYPE. Twenty is a Docker Compose deployment of a server, a worker, PostgreSQL and Redis, with at least 2 GB of RAM. Confirm that your team can operate Redis and a Node-based worker before you commit.
If you are moving from SuiteCRM 7, plan the work as a migration. The SuiteCRM documentation treats it as a new SuiteCRM 8 environment with 7 data moved into it, and the 7 instance must first reach 7.14.x or later. Use a staging instance, back up files and database, and review customizations, because the migration may remove non-core files under public/legacy. Custom code is the main cost driver here, and it usually needs a developer who knows both releases. Data import is the other shared task: EspoCRM documents an import feature, and both SuiteCRM and Twenty need field mapping and deduplication decisions made before go-live. Ask any implementation partner to show which records are migrated, which are archived and who signs off the test results.
Identity integration is a work item for every option, not a final step. For SuiteCRM 8, confirm that your identity provider supports the SAML logout behavior described in the 8.7.0+ reference, since IdP-initiated logout does not end the SuiteCRM session. For EspoCRM, test OIDC group-to-team mapping and note that its own 2FA is not compatible with OIDC. For Twenty, SSO sits on the Organization plan, so plan the licensing before the directory work. Internal staff should own the directory decisions, role design and go-live sign-off. Outside help suits the install hardening, migration rehearsal, integration testing and the first upgrade cycle, where a fixed written scope keeps the work measurable.
Questions buyers ask before choosing and hiring help
What drives the cost and effort of self-hosting SuiteCRM, EspoCRM or Twenty?
The software is free under each license, so the cost sits in people and infrastructure. Infrastructure includes servers, backups, monitoring and the database. People include the staff who install, configure, patch and support the system, plus any paid extensions or plans. For SuiteCRM and EspoCRM, the main recurring work is PHP and MySQL or MariaDB maintenance and upgrades. For Twenty, the stack is PostgreSQL, Redis, a server and a worker, and the Docker Compose guide asks for at least 2 GB of RAM. Ask any provider for a quote that separates one-time setup from recurring upgrades, backups, testing and support, and that states which hosting and licensing costs are included.
Can our team run a self-hosted CRM without an implementation partner?
Yes, if you already run PHP and MySQL or MariaDB, or PostgreSQL and Docker, and have an owner for upgrades and backups. The free cores of all three CRMs can be installed and operated in-house. A partner adds value when the scope includes SSO, custom modules, data migration or compliance evidence, or when no one on staff has time for patching. Be honest about the skills gap: SuiteCRM 8 and Twenty are unfamiliar stacks for many PHP shops, and EspoCRM's Formula Script and Entity Manager still need a clear owner. Check whether your team can test an upgrade on staging before deciding.
How long does a CRM implementation take, and what changes the timeline?
Duration depends on scope, not on the platform alone. The main drivers are the number of modules and workflows in use, the volume and quality of data to migrate, the number of identity integrations, the amount of custom development, and how many approvals the project needs. A plain sales pipeline with a few users is a different project from a multi-team service desk with SSO and audit requirements. Fixed-scope engagements agree scope, deliverables and timelines in writing before work starts. Ask any provider for a timeline tied to a written list of deliverables, and ask what is excluded.
What does the work need from our internal staff?
Plan for a named business owner who signs off on pipeline stages, fields and reports, and a technical owner who handles hosting, certificates, database backups, patching and access. Someone must also own user provisioning and offboarding, whether through LDAP, SAML, OpenID Connect or SCIM where those are available. For EspoCRM, cron or a scheduled task must run background jobs. For SuiteCRM, the 7-to-8 move needs people who can review customizations under the public/legacy folder. Confirm with each vendor which of these tasks you must do yourself.
Do we need paid extensions or plans for workflows and SSO?
It depends on the CRM and the feature. In EspoCRM, reports, Business Process Management and workflows come with the paid Advanced Pack, which is included in all EspoCRM Cloud plans, while the OpenID Connect and LDAP sign-in documented for the core do not require it. Sales-specific modules such as products, quotes and invoices sit in the Sales Pack. In Twenty, the pricing page lists SAML or OIDC SSO, row-level permissions and audit logs on the Organization plan, and SCIM provisioning and IP allow-listing on Enterprise. SuiteCRM 8 lists LDAP and SAML in its configuration references, so confirm which modules and workflows your edition includes. Verify each feature against the current vendor page before you sign off on a budget.
How do we move from SuiteCRM 7 to SuiteCRM 8?
SuiteCRM documents the move as a migration, not an in-place upgrade. You set up a new SuiteCRM 8 environment and move the SuiteCRM 7 data into it, after first bringing the 7 instance to the latest 7.14.x or later. The migration docs advise testing on a staging instance, backing up files and the database, and reviewing customizations, because the process may remove non-core files under the public/legacy folder. Inventory custom modules, logic hooks and integrations before you start, and plan a parallel run. Ask any partner to show how they will test customizations on staging and what rollback looks like.
How do release cadence and support windows affect upkeep?
Each project has a different rhythm, and the rhythm sets your workload. SuiteCRM 8 minor releases arrive roughly every eight weeks, and its patch releases carry only security and bug fixes. SuiteCRM 7.15 has security fixes until January 2028, and SuiteCRM expects to name a SuiteCRM 8 extended support release by Q3 2027. EspoCRM is on the 10.0 line, and Twenty ships frequent releases. Test each release on staging, because a frequent cadence means frequent upgrade work for whoever owns the system. Confirm the support window and the upgrade path in writing before you choose a version to run.
What to confirm before you commit to one platform
Start with the runtime, because it decides which of these platforms your team can actually operate. SuiteCRM 8.10.x lists PHP 8.2, 8.3 and 8.4 with MariaDB 10.6, 10.11, 11.4 and 11.8, or MySQL 8.0 and 8.4, on Apache 2.4 and Linux, Unix or macOS. EspoCRM's server configuration lists PHP 8.3 to 8.5, MySQL 8.0 or later, MariaDB 10.6 or later and PostgreSQL 15, on Apache, Nginx or IIS, and it needs cron or a scheduled task for background jobs. Twenty needs PostgreSQL and Redis, with a server, a worker and at least 2 GB of RAM in its Docker Compose guide. Check each matrix against the database and web server your platform team already patches, and confirm with the vendor which versions will be supported when your go-live date arrives, not only today.
Next, test sign-in and logout in your own identity provider. SuiteCRM 8 offers LDAP through AUTH_TYPE=ldap and SAML through AUTH_TYPE=saml, and the SAML reference notes that from 8.7.0 the implementation does not support IdP-initiated logout or POST binding to the logout service, so ending a session at the identity provider does not end the SuiteCRM session. EspoCRM supports OpenID Connect with backchannel logout and a fallback login method, but its own two-factor authentication is not compatible with OIDC. Ask Twenty which SSO options your plan includes, because its pricing page places SSO and SCIM provisioning on paid plans. Record the logout and 2FA behavior you need, then have a security engineer verify it in a test tenant.
Finally, map each required workflow to a free core or a paid extension, and check the upgrade path. EspoCRM's reports, business process management and workflows come from the Advanced Pack, and the Sales Pack adds quotes, invoices and products, so confirm whether your self-hosted edition needs those purchases and what their licensing terms are. Twenty's core includes unlimited custom objects, workflow automation and APIs, but its paid tiers add row-level permissions and audit logs. For SuiteCRM, confirm whether you will stay on SuiteCRM 7.15, which has security fixes until January 2028, or move to SuiteCRM 8, which is a migration with a staging test and customization review. Ask each vendor for its published support windows in writing, and ask your implementation partner to put the upgrade and retest effort into the fixed scope.
How DeployOpen helps choose and implement a self-hosted CRM
DeployOpen plans, implements, customizes, integrates, hardens, backs up, upgrades, documents and supports self-hosted open-source platforms inside your own cloud accounts, data centers or air-gapped networks. For a shortlist between SuiteCRM, EspoCRM and Twenty, we start by agreeing which stack your team can run and which identity and data requirements decide the choice.
How we scope
- Written scope fixes which CRM, edition and paid extensions are in and out before any work starts.
- We map your existing PHP, MySQL or MariaDB, or PostgreSQL and Redis skills against each platform's documented requirements.
- Engagements are fixed-scope, and ongoing support, upgrades and continuous testing are available as retainers.
How we build
- We deploy the chosen CRM in your environment, covering the web server, database, background jobs and backups.
- We configure identity sign-in, such as SAML, LDAP or OpenID Connect, and test logout behavior against your identity provider.
- Customizations are built to survive upgrades, and we test them on a staging instance before any change reaches production.
How we hand over
- Deliverables include deployment documentation, configuration records, customization notes and the upgrade and backup procedures.
- We document which features depend on paid editions or extensions, so your licensing position is clear at handover.
- Your team receives a runbook covering routine upgrades, restores and the checks to run after each vendor release.
How we support
- Retainers cover ongoing support, scheduled upgrades and continuous security testing of the running CRM.
- Security testing of the application, its APIs and its hosting is available as a separate scoped engagement.
- Before any migration between CRMs or major release lines, we agree a written plan that includes a rollback path.
